[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

-2:2021 -Information technology- Abstract Syntax Notation One (ASN.1) - Part 2: Information object specification. (International Organization for Standardization, Geneva, Switzerland) [or as amended].
Available at                                                                                |
|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [ISO8825]   | International Organization for Standardization/International Electrotechnical Commission (2015) ISO/IEC 8825-1:2015- Information technology -ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER) Part 1. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/81420.html |
| [PKCS1]     | Moriarty K, Kaliski B, Jonsson J, Rusch A (2016). Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.2. (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 8017. Available at https://www.rfc-editor.org/rfc/rfc8017                                                                                |
| [SECG]      | Certicom (2009) Standards for Efficient Cryptography, SEC 1: Elliptic Curve Cryptography, Version 2.0.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations:

t available version of the document as of the publication of this revision of SP 800-57 Part When later revisions of these referenced documents are available, those versions should referenced instead.
|
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CC                                                                                | Evaluation Criteria for IT Security, International Organization for Standardization, ISO/IEC 15408-1, December 2009. https://www.iso.org/standard/50341.html                                                                                |
| CertiPath KR                                                                                | CertiPath Key Recovery Policy , CertiPath, December 2013.

Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Computer Security Division 2007 Annual Report:

- Evaluate  security  policies  and  technologies  from  the  private sector and national security systems for potential federal agency use Hosted a growing repository of federal agency security practices, public/private security practices, and security configuration checklists for  IT  products. In  conjunction  with  the  Government  of  Canada's Communications Security Establishment, CSD leads the Cryptographic Module Validation Program (CMVP). The Common Criteria Evaluation and Validation Scheme (CCEVS) and CMVP facilitate security testing of IT products usable by the federal government. - Solicit recommendations of the Information Security and Privacy Advisory  Board  on  draft  standards  and  guidelines  Solicited recommendations  of  the  Board  regularly  at  quarterly  meetings  on topics such as updates to special publications supporting the FISMA Implementation Project. - Provide outreach, workshops, and briefings Conducted ongoing awareness  briefings  and  outreach  to  our  customer  community  and beyond  to  ensure  comprehension  of  guidance  and  awareness  of planned  and  future  activities. We  also  held  workshops  to  identify areas our customer community wishes to be addressed, and to scope guidelines in a collaborative and open format. - Satisfy annual NIST reporting requirement Produced an annual report  as  a  NIST  Interagency  Report  (IR). The  2003-2006  Annual Reports are available via the Web or upon request. I T products make claims as to their functional and/or security capabilities. When protecting sensitive data, government agencies need to have a minimum level of assurance that a product's stated security claim is valid. There are also legislative restrictions regarding certain types of technology, such as cryptography, that require federal agencies to use only tested and validated cryptographic modules.

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers:

| Field Name                        | Description                                                                                |
|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Target Operational Environment    | The IT product's operational environment, such as Standalone, Managed, or Custom (with description, such as Specialized Security-Limited Functionality, Legacy, or United States Government). Generally only applicable for security compliance/vulnerability checklists. |
| Checklist Type                    | The type of checklist, such as Compliance, Vulnerability, and Specialized. |
| Checklist Installation Tools      | Describes the functional tools required to use the checklist to configure the system, if they are not included with the checklist. |
| FIPS 140-2 Compliance             | Whether the product can operate in a FIPS 140-2 validated mode (yes or no).

National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

- 1) Agency management should ensure that computer security has the highest level of management involvement. This involvement is also important in the computer security planning process. Computer security benefits from the multiple perspectives of and input from agency IRM, computer security, and functional, user, and applications personnel
- 2) Agency management should identify and describe the security needs of their systems which contain sensitive information. - 3) Agency management should recognize the importance of computer security and its required planning. This recognition should be aggressively communicated to their staffs, perhaps using their computer security and awareness training programs as one of the vehicles. - 4) Agencies should incorporate computer security planning with other information systems planning activities. - 5) Agencies should consider the protection requirements for integrity and availability on an equal basis with that of confidentiality. - 6) Agencies should assess risks and select and implement realistic controls throughout the system life cycle. This involves awareness of technology changes with regard system hardware and software. This awareness also requires a knowledge of new technology and new methods for protecting and recovering from system threats. - 7) Atjcncic:; should implement certification and accreditation programs.

1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1:

| Executive Summary................................................................................................................... 1   | Executive Summary................................................................................................................... 1                                                                                | Executive Summary................................................................................................................... 1                                                                                | Executive Summary................................................................................................................... 1   |
|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction ........................................................................................................................ | 1. Introduction ........................................................................................................................ | 1. Introduction ........................................................................................................................

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendation for Existing Application-Specific Key Derivation Functions:

To protect the integrity of communications, a session key, SKEY , is derived from a secret authorization value, Auth , that is a secret key shared between the TPM and the application. An HMAC-PRF is used to produce the SKEY as follows:

- (1) The TPM KDF is performed in the context of a TPM session (i.e. performed between a TPM and an application with a shared authorization value.)

Recommendation for Existing Application-Specific Key Derivation Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

1 While agencies are required to follow NIST guidance in accordance with OMB policy, there is flexibility within NIST's guidance in how agencies apply the guidance.  Unless otherwise specified by OMB, the 800-series guidance documents published by NIST generally allow agencies some latitude in the application.  Consequently, the application of NIST guidance by agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems.  When assessing federal agency compliance with NIST guidance, auditors, evaluators, and assessors should consider the intent of the security concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions.

Provide system functionality testing and/or validation procedures to ensure that the system is operating correctly.  This section may be combined with the Data Testing section if procedures test both the functionality and data validity.  Teams or persons responsible for each procedure should be identified. An example of a functional test for a low-impact system may be logging into the system and running a report or performing a transaction to see if the system is operating correctly.  Detailed functionality test procedures may be provided in Appendix E, System Validation Test Plan.

-  Keystroke-level recovery steps;
-  System installation instructions from tape, CD, or other media;
-  Required configuration settings or changes;
-  Recovery of data from tape and audit logs; and
-  Other system recovery procedures, as appropriate.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

| 1. | Introduction........................................................................................................................... 1   |
|------|---------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1  | Background....................................................................................................................1             |
| 1.2  | Purpose and Scope.........................................................................................................1                 |
| 2. | Characteristics of PIV Implementations ............................................................................ 3                       |
| 2.1  | Benefits of the Complete Implementation.....................................................................3                               |
| 2.2  | Qualities of the Complete Implementation....................................................................4                               |
| 2.3  | Interoperability Qualities...............................................................................................5                  |
| 2.4  | Infrastructure Requirements ..........................................................................................6                     |
| 3. | Threat Environment.............................................................................................................

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

tion of Volume 1.......................................................................................................3                                                                          |
| 2.
Overview of an Automated Security Control Assessment Process .......................................4                                                                                |
| 2.1 Prerequisites to Automated Security Control Assessment......................................................4                                                                                |
| 2.2 Automating the Test Assessment Method................................................................................5                                                                                |
| 2.2.1 Terms for Referring to Assessment Objects......................................................................6                                                                                |
| 2.3 Factors for Determining When to Trust Automated Ongoing Assessments ...........................6                                                                                |
| 2.4 An Automated Security Control Assessment Program: ISCM................................................7                                                                                |
| 2.5 Preparing for Automated Security Control Assessments........................................................9                                                                                |
| 3.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

The SCAP Validation Program uses several reference implementation tools that aid in the development and testing of SCAP products. The SCAP Validation (SCAPVal) Tool may be used for checking the correctness of SCAP data streams; SCAPVal is required during formal SCAP validation testing. Reference implementation tools may be used to process SCAP content; these tools are not required during formal SCAP validation testing. The SCAP Validation Tool and reference implementation tools are discussed in more detail below.

Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to SRI International_ Improving the Security of Your UNIX System:

3.2.2       | The showmount Command                |   28 |
| 3. 3.2.2 The showmount Command

The showmount command [Sun88a, 1764] can be used on an NFS file server to display the names of all hosts that currently have something mounted from the server.

SRI International_ Improving the Security of Your UNIX System


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

3.2.1. 3.2.1. 3.2.1.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Media Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Building a Cybersecurity and Privacy Learning Program:

acy training. Some organizations may need to require visitors and/or guests to sign acceptable use policies if they allow them any type of system access, including use of wireless network connections.
- All users: This is also known as 'general workforce training' and includes regularly scheduled (often annual but preferably more frequent) cybersecurity and privacy training for all system users, including personnel without access to the system. An analysis of this audience's training requirements should include reviewing the performance of previous program elements and any new organizational requirements. - Privileged access account holders: These are personnel with additional responsibilities who are trusted to perform cybersecurity- or privacy-relevant functions that ordinary users are not authorized to perform. They will require additional training in order to be provided with privileged access accounts. When identifying privileged access account holders, consider:
- o Whether new systems have been implemented or are planned and the rights and privileges associated with privileged access accounts
- o Whether the list of participants with system owners is complete and whether new rights and privileges are required
- o Whether any of these systems have been moved to the cloud and require new training
- Staff with significant cybersecurity and/or privacy responsibilities training: Some positions require role-based training for staff with significantly specialized responsibilities. This type of training includes:
- o Specialized or customized training on specific products, networks, systems, applications, or information
- o Work role tasks and activities, such as incident response procedures, oversight responsibilities, or identity management
- o Reskilling and upskilling programs
- o Learning that helps the employee perform their work tasks

Building a Cybersecurity and Privacy Learning Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report:

gement, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.
|                                                                                | Introduction: Workshop Objective, Participants, and Agenda.......................................1                                                                                |
|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Workshop Session Highlights and Summaries................................................................5                                                                                |
| HPC                                                                                | Architecture and Security Posture ........................................................................5                                                                                |
|                                                                                | HPC Operator Security Experience...............................................................................6                                                                                |
|                                                                                | Risk Management Framework Development, Implementation, and Assessment.........7                                                                                |
| 2.3.1.

3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

| Function Unique Identifier | Function | Category Unique Identifier | Category | |------------------------------|------------|------------------------------|--------------------------------------------------------| | ID | Identify | ID.AM | Asset Management | | ID | Identify | ID.BE | Business Environment | | ID | Identify | ID.GV | Governance | | ID | Identify | ID.RA | Risk Assessment | | ID | Identify | ID.RM | Risk Management Strategy | | ID | Identify | ID.SC | Supply Chain Management | | PR | Protect | PR.AC | Identity Management, Authentication and Access Control | | PR | Protect | PR.AT | Awareness and Training | | PR | Protect | PR.DS | Data Security | | PR | Protect | PR.IP | Information Protection Processes and Procedures | | PR | Protect | PR.MA | Maintenance | | PR | Protect | PR.PT | Protective Technology | | DE | Detect | DE.AE | Anomalies and Events | | DE | Detect | DE.CM | Security Continuous Monitoring | | DE | Detect | DE.DP | Detection Processes | | RS | Respond | RS.RP | Response Planning | | RS | Respond | RS.CO | Communications | | RS | Respond | RS.AN |

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Digital Identity Guidelines:

1.3.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.3.2. Authentication Process

3.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

3.3.4 Technology Limitations

Although network-based IDPSs offer extensive detection capabilities, they do have some significant limitations. 3.3.4 Technology Limitations

Although wireless IDPSs offer robust detection capabilities, they do have some significant limitations.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

| Subcategory | Applicability to the Ground Segment | References | |---------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------| | ID.AM-1 : Physical devices and systems within the organization are inventoried | Organizations should document and maintain an inventory of the components, to include cloud-based resources, that reflect the current system.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 2)

[Assistant]
rce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official.
This publication may be used by nongovernmental organizations on a voluntary basis, and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-53B Natl. Inst. Stand. Technol. Spec. Publ. 800-53B, 85 pages (October 2020)

CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Certain commercial entities, equipment, or materials may be identified in this document to describe an  experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Control Baselines for Information Systems and Organizations

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommendation for Existing Application-Specific Key Derivation Functions provide?

[Assistant]
## NIST Special Publication 800-135 Revision 1

## Recommendation for Existing Application-Specific Key Derivation Functions

Quynh Dang

Computer Security Division Information Technology Laboratory

## C O M P U T E R   S E C U R I T Y

December 2011

<!-- image -->

U.S. Department of Commerce

John Bryson, Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary for Standards and Technology and Director

## Abstract

Cryptographic keys are vital to the security of internet security applications and protocols. Many widely-used internet security protocols have their own applicationspecific Key Derivation Functions (KDFs) that are used to generate the cryptographic keys required for their cryptographic functions. This Recommendation provides security requirements for those KDFs. KEY WORDS: Cryptographic key, shared secret, Diffie-Hellman (DH) key exchange, hash function, Key Derivation Function (KDF), Hash-based Key Derivation Function, Randomness Extraction, Key expansion, Pseudorandom Function (PRF), HMAC, ANS X9.42-2001, ANS X9.63-2001, IKE, SSH, TLS, SRTP, SNMP and TPM. ## Acknowledgements

The author gratefully appreciates the comments and contributions of the many reviewers in various Federal agencies and the public. In particular, the author would like to thank Elaine Barker, William E. Burr, Lily Chen, Tim Polk, Tim Hall, Scott Rose and Hugo Krawczyk. ## NIST SP 800-135, Revision 1

## Table of Contents

| 1        | Introduction........................................................................................ | Introduction........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

Participants indicated topics that their security awareness programs addressed via training courses, events, or other communications in the past 1 - 2 years. Figure 9 shows the security awareness topics and percentages of programs addressing those topics. All participants' programs covered the topic of social engineering, and over 90% addressed passwords and authentication, malware, and privacy topics. Security considerations when installing or updating software was the least covered topic but still addressed by 64% of programs.

- 'I do consult with members of the SOC [Security Operations Center] to see if there's anything glaring that I need to include in my training each year.' (N09)
- 'Also working with the help desk, just what type of problems our users encounter that are related to security issues.' (S05)
- 'Being tied directly to the cybersecurity policy team has made it easier because the awareness team always has whatever the latest guidance is and can push that out very quickly.' (D03)
- 'We've worked closely with the information security officials' (N08)
- 'I'm located in the chief information security office, and there are…divisions in that office that provide a wide range of cybersecurity services to the Department. And those managers have responsibilities for things such as identity management, internet response, data loss prevention. So, within any year, I reach out to those stakeholders to ask, 'What's important for the user to understand about cybersecurity awareness? What do you want to talk to the customer about? What kind of behaviors are you seeing that you want us to help encourage them to do or not to do?.' (D01)
- 'Build relationships with offices within your organization- Incident Response, Help Desk,…FISMA Compliance.' (Q24)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Trust Considerations for Digital Twin Technology provide? (Part 3)

[Assistant]
itions between states of these entities. This report discusses the concept and purpose of digital twin technology and describes its characteristics, features, functions, and expected operational uses.
This report also discusses both traditional and novel cybersecurity challenges presented by digital twin technology as well as trust considerations in the context of existing NIST guidance and documents. ## Keywords

computer cybersecurity; control; digital twin technology; instrumentation; real-time command; real-time monitoring; simulation; standards; testing; trust; use case scenarios. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Audience

This publication is intended for anyone who wants to understand the underlying technology and envisioned capabilities of digital twin technology. It is particularly applicable to Standards Developing Organizations (SDOs) and implementers of digital twin technology. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

Security and Trust Considerations for Digital Twin Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories:

| EXECUTIVE SUMMARY.........................................................................................................VII | EXECUTIVE SUMMARY.........................................................................................................VII | EXECUTIVE SUMMARY.........................................................................................................VII | | |------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------| | 1.0 | INTRODUCTION..................................................................................................................1 | INTRODUCTION..................................................................................................................1 | | | 1.1 | Purpose and Applicability ......................................................................................................1 | Purpose and Applicability ......................................................................................................1 | | | 1.2 | Target Audience.....................................................................................................................1 | Target Audience.....................................................................................................................1 | | | 1.3 | Relationship to Other Documents ..........................................................................................1 | Relationship to Other Documents ..........................................................................................1 | | | 1.4 | Organization of this Special Publication................................................................................2 | Organization of this Special Publication................................................................................2 | | | 2.0 | PUBLICATION OVERVIEW...............................................................................................4 | PUBLICATION OVERVIEW...............................................................................................4 | | | 2.1 | Agencies Support the Security Categorization Process .........................................................4 | Agencies Support the Security Categorization Process .........................................................4 | | | 2.2 | Value to Agency Missions, Security Programs and IT Management ....................................4 | Value to Agency Missions, Security Programs and IT Management ....................................4 | | | 2.3 | Role in the System Development Lifecycle...........................................................................5 | Role in the System Development Lifecycle...........................................................................5 | | | 2.4 | Role in the Certification and Accreditation Process ..............................................................5 | Role in the Certification and Accreditation Process ..............................................................5 | | | 2.5 | Role in the NIST Risk Management Framework...................................................................6 | Role in the NIST Risk Management Framework...................................................................6 | | | 3.0 | SECURITY CATEGORIZATION OF INFORMATION AND

Guide for Mapping Types of Information and Information Systems to Security Categories


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs provide?

[Assistant]
<!-- image -->

## Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs

Anoop Singhal Ximming Ou

## NIST Interagency Report 7788

Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs

## Anoop Singhal Ximming Ou

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

August 2011

<!-- image -->

U.S. Department of Commerce

Rebecca M. Blank, Acting Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in federal computer systems. This Internal Report discusses ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Interagency Report 7788 # pages (August 2011)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Bluetooth Security:

Bluetooth wireless technology and associated devices are susceptible to general wireless networking threats, such as denial of service (DoS) attacks, eavesdropping, man-in-the-middle (MITM) attacks, message modification, and resource misappropriation. They are also threatened by more specific attacks related to Bluetooth wireless technology that target known vulnerabilities in Bluetooth implementations and specifications. Attacks against improperly secured Bluetooth implementations can provide attackers with unauthorized access to sensitive information and unauthorized use of Bluetooth devices and other systems or networks to which the devices are connected.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

1. Name of the project, and a description of the purpose and scope.
2. Mission requirement the system is designed to satisfy.
3. Estimated costs (capital investment and operations) for each fiscal year 1989-1993.
4. Description of input (typewritten text, invoices, receipts, forms, drawings, etc.). If practical, attach examples of documents that illustrate the various types of information that
5. will be captured. For example, if documents contain both text and image, provide a sample of that type of document.
5. Description of the origin of the input including both the type and location of organizations supplying the documents and the technology that the supplier uses to create the documents, if known
6. Description of the conversion and input process, including scanning system, authentication procedures, use of outside contractors, quality control and data loading procedures.
7. Proposed accuracy of stored image (150 dots per inch, 200 dots per inch, etc.).
8. Storage format for images (Group 4 FAX, etc.).
9. Description of proposed work station for retrieval (including screen resolution, number and size of screens, communications speed and protocol, zoom, local storage capacity, etc.).
10. Volume of stored images (in pages and bytes) to be captured initially, total volume online each year FY 1989-1993, volume removed from online access (archived or destroyed) each year FY 1989-1993.
11. Response time for online document retrieval.
12. Brief description of the operation of the indexing and storage system (index keys, searching techniques, off-the-shelf system, etc. )
13. A description of unique functions, capabilities, or performance standards (such as large format hardcopy output, grey scale image enhancement, etc.) required by this system that will make it different from commercially available systems.
14. The name and telephone number of a point of contact who can provide more information.

1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters:

3.2.3                                                                                | 3. 3.2.3  Protecting Personal Voter Information

Voter registration applications and absentee ballot requests contain personally identifiable information, such as names, addresses, and identification numbers. 3.2.3, forms developed by state and local jurisdictions for voter registration and ballot requests should not ask for information that is not required or desired by jurisdictions.

Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out provide? (Part 5)

[Assistant]
| INTRODUCTION                                                       |          |
|      | A. | Document Purpose. Scope and Audience                               | 1-1 1-1  |
|      | B.
| Not a Substitute for Good Computer Security Management             | 1-1      |
|      | 0. | Security is not a One-time Activity                                | 1-2      |
|      | D. | Obtaining Computer Security Services: In-house vs. Contracting Out | .... 1-2 |
|      | E. | Overview of the Document                                           | 1-2      |
|      | F. | The Evolving Nature of this Document                               | 1-4      |
|      | G. | Conventions in this Document                                       | 1-5      |
|      |                                          | Sources of Information                                             | 1-5      |
|      | H. | Additional                                                         |          |
| II. | COMPUTER                                 | COMPUTER                                                           |          |
|      |                                          | SECURITY PROGRAM MANAGEMENT                                        | Il-l     |
|      | A. | Overview                                                           | Il-l     |
|      | B. | Development of a Computer Security Program                         | 11-2     |
|      | C. | Program Assessment                                                 | 11-7     |
| III. |                                          | APPLICATION SECURITY                                               | Ill-l    |
|      | A. | Overview                                                           | Ill-l    |
|      | B. | Computer Security and Privacy Plan Preparation                     |          |
|      |                                          | (lAW OMB CIR 90-08)                                                | III-4    |
|      | C.

Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

De-Identifcation . . . . . | 18  |
| 3.2. | Evaluating the Risks and Benefts That Arise from De-Identifed Data Re- leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
| Evaluating the Risks and Benefts That Arise from De-Identifed Data Re- leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19  |
|                                                                            | 3.2.1. | Probability of Re-Identifcation . . . . | 21  |
|                                                                            |                                                                                | 3.2.2. Adverse Impacts of Re-Identifcation . | 24  |
|                                                                            |                                                                                | 3.2.3. Impacts Other Than Re-Identifcation                                                                                | 26  |
|                                                                            |                                                                                | 3.2.4. Remediation . . . . . . . . . . . . . . . | 27  |
|                                                                            |                                                                                | Data Life Cycle                                                                                |     |
| 3.3. . . | 3.3. . . | . . . . . . . . . . . . . . . . | 27  |
| 3.4. Data-Sharing Models . | 3.4.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to Fiscal Year 2021 Cybersecurity and Privacy Annual Report:

| Foreword........................................................................................................................................................... |   1 |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| Focus Area 1: Cryptographic Standards and Validation................................................................ |   2 |
| Focus Area 2: Cybersecurity Measurement........................................................................................ |   6 |
| Focus Area 3: Education and Workforce.............................................................................................. |   9 |
| Focus Area 4: Identity and Access Management............................................................................. |  12 |
| Focus Area 5: Privacy Engineering......................................................................................................... |  15 |
| Focus Area 6: Risk Management ............................................................................................................ |  18 |
| Focus Area 7: Trustworthy Networks.................................................................................................... |  25 |
| Focus Area 8: Trustworthy Platforms.................................................................................................... |  31 |
| ITL Leadership and Participation in National and International Standards Programs...... |  35 |
| Opportunities to Engage with the NIST on Cybersecurity and Privacy................................... |  37 |

Fiscal Year 2021 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

| Category | Subcategory and Selected Informative References | Ransomware Application | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | PR.DS-5: Protections against data leaks are implemented ISO/IEC 27001:2013 A.12.1.3, A.17.2.1 NIST SP 800-53 Rev.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report) provide? (Part 2)

[Assistant]
ecurity and Privacy Plan (CSPP) review effort that was conducted in response to the Act by a joint team from NIST and NSA in 1989. The report also discusses future directions for implementing the Act.
The Computer Security Act of 1987 (the Act) has further increased our growing awareness that information and information resources are integral to the functioning of government -and that their protection is fundamental, not peripheral to, the government serving the public trust. We applaud and support the efforts undertaken under the Act and welcome the opportunity to further serve in this area. We would like to acknowledge, congratulate, and thank the many individuals and agencies that took the time and effort to seriously examine their computer security programs and plans. We are proud of the vital role that our organizations play in supporting the Act's goals. We look forward to continued cooperation between our organizations in carrying out the spirit of the Computer Security Act to better serve the federal community and, ultimately, the public. <!-- image -->

<!-- image -->

National Computer Systems Laboratory National Institute of Standards and Technology

National Computer Security Center National Security Agency

We appreciate the opportunity to participate in this historic chapter of promoting the protection of federal information and information technology resources. We take pride in the manner in which our organizations and staffs worked together and in what this project has started. We thank those who participated in this initial journey and who contributed to our collective learning about the challenges we face and how we address them. <!-- image -->

<!-- image -->

Jr.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop:

- In his opinion, IoT security has not received enough attention, in both consumer and organizational contexts. He noted that the increasing interconnection of systems of all types increases attack surfaces and expands the threat profile. - He identified three core activities that the Office of Management and Budget (OMB) performs that are particularly relevant to federal information system security:
- o Overseeing the implementation of Federal Information Security Management Act (FISMA) for non-National Security Systems; he noted that in doing this OMB works closely with the Department of Defense (DoD) and the Director of National Intelligence (DNI) to present consistent guidance across the federal space including the DoD and the intelligence community (IC). - o Overseeing the implementation of cybersecurity policies and standards. He noted that OMB has been taking a more active oversight role and seeking to assist federal organizations in meeting their FISMA responsibilities. - o Ensuring agencies comply with government-wide cybersecurity guidance and legislation, including Binding Operational Directives and Emergency Directives from the Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA). - He stated that the scope of 'Federal Information systems includes IoT devices', adding 'I don't think we've had enough conversation on that.' He expressed concern that IoT devices are seen as less impactful or less risky, and cited an example of a networked traffic sign being used as an entry point for a cyber-attack as a 'wake-up call' to the range of concerns that IoT raises. - He emphasized that OMB's work in cybersecurity is guided by a risk management philosophy. He described a 'high-value asset' program intended to assist agencies in identifying and protecting their high-value information system and data, and share solutions across agencies.

Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

in coordination with the other senior agency officials, reports annually to the agency head on the effectiveness of the agency information security program, including the progress of remedial actions.
- Heading an office with the mission and resources to assist in ensuring agency compliance with information security requirements;
- Periodically assessing risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency;
- Developing and maintaining risk-based, cost-effective information security policies, procedures, and control techniques to address all applicable requirements throughout the life cycle of each agency information system to ensure compliance with applicable requirements;
- Facilitating development of subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems;
- Ensuring that agency personnel, including contractors, receive appropriate information security awareness training;
- Training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities;
- Periodically testing and evaluating the effectiveness of information security policies, procedures, and practices;
- Establishing and maintaining a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;
- Developing and implementing procedures for detecting, reporting, and responding to security incidents;
- Ensuring preparation and maintenance of plans and procedures to provide continuity of operations for information systems that support the operations and assets of the agency; and
- Supporting the agency CIO in annual reporting to the agency head on the effectiveness of the agency information security program, including progress of remedial actions.

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

touching the smart card's contact pad. The PIV contact interface is standardized by International Organization of Standards / International Electrotechnical Commission (ISO/IEC) 7816-3 [ISO/IEC7816].
|
|-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Contactless Reader                      | A smart card reader that communicates with the integrated circuit chip in a smart card using radio frequency (RF) signaling. The PIV contactless interface is standardized by [ISO/IEC 14443]. |
| Controller (or Control Panel, or Panel) | A device located within the secure area that communicates with multiple PIV Card readers and door actuators, and with the Head End System. The PIV Card readers provide cardholder information to the controller, which it uses to make access control decisions and release door-locking mechanisms. The controller communicates with the Head End System to receive changes in access permissions, report unauthorized access attempts and send audit records and other log information. Most modern controllers can continue to operate properly during periods of time in which communication with the Head End is disrupted and can journal transactions so that they can be reported to the Head End when communication is restored.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Cryptographic Key Generation:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in Federal  information  systems.  The  Special  Publication  800-series  reports  on  ITL's  research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Recommendation for Cryptographic Key Generation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Security Analysis of First Responder Mobile and Wearable Devices:

Scott Ledgerwood Public Safety Communications Research Division Communications Technology Laboratory

Jaydee L. Griffith Institute for Telecommunication Sciences National Telecommunications and Information Administration

First and foremost, the authors wish to gratefully acknowledge the contributions of the public safety professionals offering their time and rich expertise to this study. Additionally, information gleaned from the Association of Public-Safety Communications Officials (APCO), specifically Mark Reddish, was invaluable. The authors also would like to thank their colleagues who reviewed drafts of this document and contributed to its technical content including John Beltz, Michael Ogata, Andrew Regenscheid, and Nelson Hastings of NIST; Vincent Sritapan of DHS S&T.

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Glossary of Computer Security Terminology:

independent technical personnel according to an acceptable standard of proof such that the level of security protection is identified with regard to a procedure, program, system component, or system.
(OPNAVINST 5239.1 A)

| eavesdropping                   | The unauthorized interception of information- bearing emanations through the use of methods other than wiretapping. (FIPS PUB 39; AR 380-380)                                                                                |
|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| economic assessment             | A detailed study of security measures, their operational and technical feasibility, and their costs and benefits. Economic assessment aids in planning and selecting security measures. (AFR 205-16, AFR 700-10)                                                                                |
| electromagnetic emanations      | Signals transmitted as radiation through the air and through conductors. (FIPS PUB 39; AR 380-380)                                                                                |
| electronic funds transfer (EFT) | Electronic funds transfer refers to the movement of value (money) from one party to another by electronic means.

Glossary of Computer Security Terminology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

## A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments

## A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments

Chandramouli R, Butcher Z (2023) A Zero-Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-207A. https://doi.org/10.6028/NIST.SP.800-207A

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

3.2.2 Conduct Initial Planning

The procurement official (under the Contracting role in Section 3.

Notional Supply Chain Risk Management Practices for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Glossary of Computer Security Terminology:

y, or integrity ofcomputer resources. Computer abuse includes fraud, embezzlement, theft, malicious damage, unauthorized use, denial ofservice, and misappropriation. Levels of computer abuse are:
- a.
MinorAbuse - Acts that represent managementproblems (printing calendars or running games), but do not impact system availability for authorized applications;
- b. Major Abuse - Unauthorized use (possibly criminal), resulting in denial ofservice, multiple instances of minor abuse, or waste;


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

- Impacts on business operations (e.g., damage to equipment and personnel, the creation of fake orders that require human effort to sort and remove)
- Impacts on customer relationships (e.g., scalpers automatically buying inventory to relist at a higher price elsewhere)
- Infrastructure co-opted for abuse or harassment (e.g., multi-factor authentication fatigue attacks, where an attacker triggers text spam to a user's phone via an SMS 2factor authentication system [9])
- Unplanned expenses (e.g., consuming far more of a third-party service than planned by satisfying requests made by a malicious user)

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Security Perspective on the Web3 Paradigm provide? (Part 3)

[Assistant]
tegration of these developing technologies may present novel security challenges, so this paper presents security considerations that should be addressed when considering Web3 technology and adoption.
## Keywords

blockchain; cryptocurrency; data; decentralized; decentralized identity; non-fungible tokens; smart contracts; tokens; Web3. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Audience

This publication is designed for readers with little or no knowledge of Web3 technology who wish to understand how it works at a high level. It is not intended to be a technical guide. The discussion of the technology provides a conceptual understanding, and some examples, figures, and tables are simplified to fit the audience. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

A Security Perspective on the Web3 Paradigm


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide?

[Assistant]
## NIST Special Publication 800-218

## Secure Software Development Framework (SSDF) Version 1.1:

Recommendations for Mitigating the Risk of Software Vulnerabilities

Murugiah Souppaya Karen Scarfone Donna Dodson

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-218

<!-- image -->

## NIST Special Publication 800-218

## Secure Software Development Framework (SSDF) Version 1.1:

Recommendations for Mitigating the Risk of Software Vulnerabilities

Murugiah Souppaya Computer Security Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Donna Dodson*

* Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-218

February 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

.................9                    |
| 2.6.1. Input Validation..........................................................................................................................11 |
| 2.6.2.
Malicious Input Protection.........................................................................................................11        |
| 2.7.1. Gateways Straddle Boundaries ..................................................................................................12            |
| 2.7.2. Requests With a Service Identity But No User Identity..............................................................12                        |
| 2.7.3. Requests With a User Identity But No Service Identity..............................................................13                        |
| 2.7.4. Requests With Both User and Service Identities........................................................................14                     |
| 2.7.5. Reaching Out to Other Systems .................................................................................................15            |
| 2.7.7. Identity Canonicalization............................................................................................................16      |
| 3. Recommended Controls for APIs...................................................................................................17               |
| 3.1.1. Basic Pre-Runtime Protections...................................................................................................18           |
| 3.1.2. Advanced Pre-Runtime Protections ...........................................................................................19               |
| 3.2.1. Basic Runtime Protections..........................................................................................................20        |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

| Audience.........................................................................................................
| 2                                                                                |
|                                                                                | Document Structure........................................................................................ | 3                                                                                |
| 2. Overview of Manufacturing Systems ...................................................................4                        | 2. Overview of Manufacturing Systems ...................................................................4                        |                                                                                |
| CSF Manufacturing Profile Overview ...................................................................5                          | CSF Manufacturing Profile Overview ...................................................................5                          |                                                                                |
| 4. CSF Manufacturing Profile Implementation Approach.......................................6                                     | 4. CSF Manufacturing Profile Implementation Approach.......................................6                                     |                                                                                |
| 5.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings:

| 1                  | Introduction ............................................................................................................1   | Introduction ............................................................................................................1   |
|--------------------|------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| 2                  | 1.2                                                                                | About the IoT Cybersecurity Colloquium......................................................... 1                            |
|                    | Summary and Key Takeaways..............................................................................3                     | Summary and Key Takeaways..............................................................................3                     |
|                    | 2.1                                                                                | Defining the Internet of Things........................................................................ 3                    |
|                    | 2.2                                                                                | IoT Cybersecurity and Privacy Risks .............................................................. 3                         |
|                    | 2.3                                                                                | IoT-Specific Risks ...........................................................................................

Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings